DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:from:to:subject:date:message-id:references
	:in-reply-to:content-type:content-transfer-encoding
	:mime-version; q=dns; s=default; b=ktrfG+Ghm3FNPrLkB5/TDAvoPLn2/
	NknmEktd86NmzyJehhaI0u9831xE8TmpomlO5DZfVViDwzqbyki9qaXEBZlxuMks
	ecx/RXudsrPZAw7w4TLOwNTGgQNaNXjUmT1DqJLxc/eP4z8Cx/8uC9fe6pxD5iPy
	slScsPpneJ0njk=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
From: "Lavrentiev, Anton (NIH/NLM/NCBI) [C]" <lavr@ncbi.nlm.nih.gov>
To: "cygwin@cygwin.com" <cygwin@cygwin.com>
Subject: RE: get rid of getpwent? (Was: cygwin-1.7.28 getpwent header declaration changes ?)
Date: Fri, 7 Feb 2014 21:49:44 +0000
Message-ID: <5F8AAC04F9616747BC4CC0E803D5907D0C47C45C@MLBXv04.nih.gov>
References: <52F339CA.5070305@gmail.com> <20140206090117.GD2821@calimero.vinschen.de> <52F361C5.3000807@gmail.com> <20140206141321.GI2821@calimero.vinschen.de> <52F40208.5030901@etr-usa.com> <20140207094917.GN2821@calimero.vinschen.de> <52F53D7C.5050201@etr-usa.com> <20140207213013.GT2821@calimero.vinschen.de>
In-Reply-To: <20140207213013.GT2821@calimero.vinschen.de>
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

> I think SAM/AD will be mostly quicker

I do not want to be a party pooper here, but have you checked how
the AD approach will work from the unmanaged Windows service accounts?

We've been experiencing rather nasty effects of the M$ design that
when a host changes its password (it is required to, every so many
days), it is no longer considered an "authorized" agent (rather,
anonymous).  Accessing AD anonymously (esp. from system-managed
service account) is limited;  like when you request a list,
you get only first 100 (who at M$ had invented this?!) entries.
Which means that if your code is scanning, it won't find
more than 100 users (and they are alphabetized, so the "excess"
users will simply disappear from view).  That creates false-positive
nonexistent users / groups.  The only remedy is to restart the host...

P.S.  I'm not an AD person, and some of the info from the above
comes from our sysadmins (how they see things unfolding).

Anton Lavrentiev
Contractor NIH/NLM/NCBI